PT-2015-5865 · Websense · Websense V-Series+1

Cengiz Han Sahin · Publicado 2015-03-26 · Atualizado 2018-10-09 · CVE-2015-2747

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Websense Triton version 7.8.3 Websense V-Series version 7.7

Description The issue allows remote attackers to inject arbitrary web script or HTML via a crafted email or HTTP request, triggering a DLP Policy. This occurs due to multiple cross-site scripting (XSS) vulnerabilities in the data loss prevention (DLP) incident Forensics Preview.

Recommendations For Websense Triton version 7.8.3, update to a version that includes a fix for the XSS vulnerabilities in the DLP incident Forensics Preview. For Websense V-Series version 7.7, update to a version that includes a fix for the XSS vulnerabilities in the DLP incident Forensics Preview.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2015-2747

Produtos afetados

Websense Triton

Websense V-Series

Referências · 5

• 🔥 https://securify.nl/advisory/SFY20140904/websense_data_security_dlp_incident_forensics_preview_is_vulnerable_to_cross_site_scripting.html · Exploit
• http://seclists.org/fulldisclosure/2015/Mar/102 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2747 · Nota de Segurança
• http://securityfocus.com/archive/1/534908/100/0/threaded · Nota
• http://packetstormsecurity.com/files/130897/Websense-Data-Security-DLP-Incident-Forensics-Preview-XSS.html · Nota